\n<\/p>\n
Google provided<\/span> Immigration and Customs Enforcement with a wide array of personal data on a student activist and journalist, including his credit card and bank account numbers, according to a copy of an ICE subpoena obtained by The Intercept.<\/p>\n Amandla Thomas-Johnson<\/a> had attended a protest targeting companies that supplied weapons to Israel at a Cornell University job fair in 2024 for all of five minutes, but the action got him banned from campus. When President Donald Trump assumed office and issued a series of executive orders targeting students who protested in support of Palestinians, Thomas-Johnson and his friend Momodou Taal went into hiding.<\/p>\n Google informed Thomas-Johnson via a brief email in April that it had already shared his metadata with the Department of Homeland Security, as The Intercept previously reported<\/a>. But the full extent of the information the tech giant provided \u2014\u00a0including usernames, addresses, itemized list of services, including any IP masking services, telephone or instrument numbers, subscriber numbers or identities, and credit card and bank account numbers \u2014 was not previously known.<\/p>\n \u201cI\u2019d already seen the subpoena request that Google and Meta had sent to Momodou [Taal], and I knew that he had gotten in touch with a lawyer and the lawyer successfully challenged that,\u201d Thomas-Johnson said. \u201cI was quite surprised to see that I didn\u2019t have that opportunity.\u201d<\/p>\n <\/p>\n The subpoena provides no justification for why ICE is asking for this information, except that it\u2019s required \u201cin connection with an investigation or inquiry relating to the enforcement of U.S. immigration laws.\u201d In the subpoena, ICE requests that Google not \u201cdisclose the existence of this summons for indefinite period of time.\u201d<\/p>\n Thomas-Johnson, who is British, believes that ICE requested that information to track and eventually detain him \u2014 but he had already fled to Geneva, Switzerland, and is now in Dakar, Senegal.\u00a0<\/p>\n The Electronic Frontier Foundation, which is representing Thomas-Johnson, and the ACLU of Northern California sent a letter to Google, Amazon, Apple, Discord, Meta, Microsoft, and Reddit last week calling on tech companies to resist similar subpoenas in the future from DHS without court intervention. The letter asks the companies to provide users with as much notice as possible before complying with a subpoena to give them the opportunity to fight it, and to resist gag orders that would prevent the tech companies from informing targets that a subpoena was issued.<\/p>\n \u201cYour promises to protect the privacy of users are being tested right now. As part of the federal government\u2019s unprecedented campaign to target critics of its conduct and policies, agencies like DHS have repeatedly demanded access to the identities and information of people on your services,\u201d the letter reads. \u201cBased on our own contact with targeted users, we are deeply concerned your companies are failing to challenge unlawful surveillance and defend user privacy and speech.\u201d<\/p>\n In addition to Thomas-Johnson\u2019s case, the letter refers to other instances in which technology companies provided user data to DHS, including a subpoena sent to Meta to \u201cunmask\u201d the identities of users who documented immigration raids in California. Unlike Thomas-Johnson, users in that case were given the chance to fight the subpoena because they were made aware of it before Meta complied.<\/p>\n Lindsay Nash, a professor at Cardozo Law and a former staff attorney with ACLU Immigrants\u2019 Rights Project, said that by not giving prior notice, Google deprived Thomas-Johnson of his ability to protect his information.<\/p>\n \u201cYour promises to protect the privacy of users are being tested right now.\u201d<\/p>\n<\/blockquote>\n<\/figure>\n \u201cThe problem is that it doesn\u2019t allow the person whose personal information is on the line and whose privacy may be being invaded to raise challenges to the disclosure of that potentially private information,\u201d Nash said. \u201cAnd I think that\u2019s important to protect rights that they may have to their own information.\u201d<\/p>\n Google did not respond to a request for comment.<\/p>\n Tech companies\u2019 data sharing practices are primarily governed by two federal laws, the Stored Communications Act, which protects the privacy of digital communications, including emails, and Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive trade practices.<\/p>\n \u201cUnder both federal law and the law of every state, you cannot deceive consumers,\u201d said Neil Richards, a law professor at Washington University St. Louis who specializes in privacy, the internet, and civil liberties. \u201cAnd if you make a material misrepresentation about your data practices, that\u2019s a deceptive trade practice.\u201d<\/p>\n Whether or not corporations are clear enough with consumers about how they collect and share their data has been litigated for decades<\/a>, Richards said, referencing the infamous Cambridge Analytica lawsuit brought by the Federal Trade Commission, alleging that the company misled Facebook users about data collection and sharing.<\/p>\n <\/p>\n\n